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Quantum cryptographic protocols solve the longstanding problem of distributing a shared secret 
string to two distant users by typically making use of one-way quantum channel. However, alterna¬ 
tive protocols exploiting two-way quantum channel have been proposed for the same goal and with 
potential advantages. Here we overview a security proof for two-way quantum key distribution pro¬ 
tocols, against the most general eavesdropping attack, that utilize an entropic uncertainty relation. 
Then, by resorting to the ‘smooth’ version of involved entropies, we extend such a proof to the case 
of finite key size. The results will be compared to those available for one-way protocols showing 
some advantages. 
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I. INTRODUCTION 

Two-way quantum key distribution (QKD) schemes have 
evolved from a theoretic framework in the context of de¬ 
terministic schemes to experimental realizations for QKD 
purposes [ij. The protocol is described by a qubit being 
sent from one party, say. Bob to another, Alice for her en¬ 
coding before being sent back to him for a measurement 
to ascertain Alice’s encoding. Standing in stark contrast 
to BB84 like prepare and measure schemes where infor¬ 
mation encoding is simply in the choice of states and 
bases of (^bits to be sent from the encoding party to the 
receiver 0, the case for two-way QKDs is really in the 
choice of unitary transformations by an encoding party 
that would act on the qubits traveling to and fro be¬ 
tween the legitimate parties. This naturally makes use 
of the quantum channel twice. Another peculiarity of the 
above-mentioned two-way protocols would be how its se¬ 
curity is to be ensured. The protocols’ runs are divided 
into two modes, namely the encoding mode (EM) where 
message encoded by Alice is followed by measurements 
by Bob for decoding purposes and the control mode (CM) 
where Alice would make projective measurements in ran¬ 
domly selected bases such that when the bases coincide 
with Bob’s then errors can be ascertained. The distribu¬ 
tion of the EM and CM would be determined by a factor 
c, with 0 < c < 1, i.e. the probability of Alice randomly 
choosing an EM. 

However, despite its early introduction in 2002 Q, and 
varying versions that followed, it was only about a decade 
later that a proper proof for one specific two-way protocol 
was found for unconditional security in Q and a proof 
for a purified version was reported in @ . In Q , the proof 
was done for the specific case of non-entangled qubits in 
one of four states coming from two mutually unbiased 
bases (this protocol has been referred to as LM05 0 and 
we shall refer to it as such hereafter). In @ , a purification 
of two two-way QKD protocol, namely the Super Dense 
Coding scheme (SDC) and LM05 was done in order to 
provide a security proof. 


Unconditional security proofs provide for an informa¬ 
tion theoretic security picture of QKD. However, a very 
important fact that sets constraints within the opera¬ 
tional context would be the issue of how such proofs are 
based on asymptotic analysis that holds true only for 
infinitely long keys; the concern regarding the security 
nature of realistic keys, which are finitely long, becomes 
evident. This has spurred a number of studies including 

[iS^. 

The central feature of this work is a review of the se¬ 
curity analysis done based on protocol purifications in 
@ and a natural generalization to the the case for finite 
sized keys. We begin with a quick description of two 
most relevant two-way QKD protocols followed by their 
purifications. After a brief on smooth entropies and its 
application to deriving finite key rates, we provide finite 
secure key rates in terms of efficiency for both protocols. 
These will then be compared to an asymmetrical BB84. 


II. TWO-WAY PROTOCOLS 

The SDC protocol in some sense is closer to the earlier 
instances of two-way protocols, namely the Ping-Pong 
Hi and more specifically its improved version [Ill which 
provides for a higher protocol capacity in terms of the 
number of classical bits encoded in each EM run. It is 
however more resource demanding as it requires the use 
of a quantum memory on Bob’s side. Our description 
of SDC here follows closely that of @. Very simply, the 
SDC protocol sees Bob sending half a Bell pair to Al¬ 
ice (while storing the other half in a quantum memory) 
for her to encode by virtue of a randomly chosen uni¬ 
tary transformation from the set containing the identity 
operator and the three Pauli operators, {I,ax,<Jy,<Jz}- 
She would subsequently submit the qubit back to Bob 
for measurements. Alternatively, she could measure the 
received qubit in the Z basis and prepare another in the 
X basis to be sent to Bob. The former process, done 
with probability c ~ 1, corresponds to her actions in 
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EM, while the latter, done with probability 1 — c, cor¬ 
responds to CM. Despite the use of 4 unitaries imply a 
larger alphabet used, particularly elements of Z 4 0,1, 2, 3 
mapped to I, ax, ay,az respectively as opposed to bits for 
encoding, Alice could in fact assign logical bits (in pairs) 
00,10,11 and 01 to the unitaries. However the mapping 
/ : Z 4 —>■ Z 2 to bits should be done only at the end of 
the protocol to avoid any possibility of Eve capitalizing 
on the correlation of bits given any pair [l^ . 

Bob on the other hand would, with a probability c 
make a Bell measurement and with probability 1 — c mea¬ 
sure his stored and received qubit in the Z and X basis 
respectively. A protocol run which sees Bell measure¬ 
ments by Bob coinciding with Alice’s unitary transfor¬ 
mations would allow Bob to distinguish between Alice’s 
unitaries perfectly (given that the Pauli matrices would 
shift between orthogonal Bell states). Assigning logical 
symbols 0,1,2 and 3 to the Bell states 
and \(j>~) respectively, these instances referred to as EM 
provide for sharing of a raw key between Alice and Bob. 
Again, it is possible for Bob to use bits instead when 
Alice submits the mapping information to Bob at the 
end of the protocol runs. The instances when Alice’s 
and Bob’s measurements in the Z and X bases coincides 
would allow for a meaningful CM. Hence a successful EM 
happens only with probability and CM happens with 
probability (1 — c)^. 

The case for a two-way QKD without using entangle¬ 
ment, namely the LM05, sees a qubit prepared by Bob 
in a particular bases randomly chosen from either the X 
or Z with probabilities px and pz respectively to be sent 
to Alice for her encoding. In the original LM05 protocol, 
apart from px = pz, only two unitary transformation 
was considered, namely the passive I and iay. In Q, a 
modification was made to include another two unitary 
transformation, namely the ax and cr^. The protocol was 
further presented in two versions, depending on the prob¬ 
abilities Px and Pz- In this protocol, upon executing her 
unitary transformation, Alice would resubmit the qubit 
to Bob who would measure in the same basis he pre¬ 
pared in. Defining the eigenstates of a^ and ax as \z±) 
and \x±) respectively, bit values 0 may be assigned to the 
states \z+) or |x-|-) and 1 to the states \z—) or |a;—). Bob 
then adds (modulo 2 ) the bit value corresponding to his 
prepared state (prior sending to Alice) to the bit value 
corresponding to his measurement result of the state (af¬ 
ter Alice’s encoding). We will mention shortly what Alice 
needs to do in order to share bit-wise information with 
Bob. This run of the protocol corresponds to a successful 
EM. 

With the probability 1 — c, Alice would make measure¬ 
ments of the qubit she receives instead in either the Z or 
X bases for CM purposes. 

Apart from the use of non entangled qubits by Bob, an¬ 
other obvious difference with the SDC is in the possible 
options in the post processing feature of the protocols. 
In SDC, post processing only includes Alice’s and Bob’s 
discussion to ascertain which signals were to be used for 


EM and CM purposes apart from error estimations, error 
corrections and privacy amplifications. In the LM05 on 
the other hand, Alice and Bob have the option to commit 
to either direct reconciliation (DR) or reverse reconcilia¬ 
tion (RR) which would determine the type of information 
to be disclosed over an authenticated public channel. In 
the case of RR, Bob should disclose the bases he prepared 
and measured qubits in. Using the same assignment of 
logical bit pairs to unitary transformations as in SDC, 
Alice would keep only the first bit of the pair when Bob 
uses Z and the second when Bob uses X. On the other 
hand, if a RR is considered, then Alice would reveal from 
which of the two sets, Sq = {I, iay} and Si = {ax,az} 
was the transformation she had used and only the first 
bit of the bit pair for each transformation is used. This 
revelation is necessary given Bob’s measurement in the 
X basis would give him an erroneous bit when Alice uses 
Si- In these cases. Bob would need to flip his bit. 


A. Purifications of Two-way Protocols 

The approach to the security proof presented in Q is 
based on the notion of purification of protocols where the 
protocols can be described by the measurements mad e by 
Alice and Bob on a system provided to them by Eve [T^ . 
Writing the measurements of Alice and Bob as Proba¬ 
bility Operator Value Measure (POVM) maps and 

respectively in EM (or and in CM), 

the state after the measurements is given by 

M\®M\,[pabe) ( 1 ) 

with i = EM or EM. In the purified version of both the 
SDC and the LM05 as reported in [^, pabe is a state in 
the Hilbert space 'Ha®'Hb®'He (Alice’s, Bob’s and Eve’s 
respectively) and 'Ha and Hb are Hilbert spaces for two 
qubit systems each. Alice’s measurement in EM 

which acts on a two qubit system must be in such a way 
that it is equivalent to her encoding operation in the pro¬ 
tocols. If we recall how in both protocols, Alice receives 
a state from Bob and resends after a unitary encoding on 
the state, can be understood as a (POVM) acting 

on the received state with half of some entangled state so 
as the other half of the entangled state (after the mea¬ 
surement is the same as the output from Alices 

encoding to be sent to Bob^. Thus we can imagine pab e 
as that pure state which distributes a pair of qubits to 
Alice and Bob each. Alice’s measurement on the two 
received qubits, ti'BE{pABE) would ensure that Bob’s 
measurement, Mg^ on his received pair, ti'AEiPABE) is 
equivalent to Alice making a unitary transformation on 
Bob’s prepared qubit for his subsequent decoding mea¬ 
surement. With regards to Bob’s measurements, Mg^, 


^ This is referred to as a purification of Alice’s encoding in Q. 
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it is instructive to note that in SDC, is really the 

Bell measurement for decoding purposes while in LM05, 
Bob’s measurement on the first half of tiAsiPABE) effec¬ 
tively prepares the qubit state sent to Alice (in the for¬ 
ward path) while his other measurement is on the other 
half of tTAEipABE)- The measurements and 
would then correspond to relevant local measurements 
of each qubit in the qubit pairs in CM (detailed in the 
ensuing section). Given these, the main ingredient in 
the security proof for the purified protocols is based on 
bounding Eve’s information gain given Bob-Alice’s us¬ 
ing an uncertainty relation which measures the overlap 
of Bob’s (Alice’s) measurement apparatus in a reverse 
(direct) reconciliation scenario. 


B. Measurements and Entropic Uncertainty 
Relations 

Entropic uncertainty relations are used in some security 
proofs of particular QKD protocols given its power to 
describe bounds of uncertainty parties may share of a 
certain quantum system, say B. In its simplest descrip¬ 
tion, it is simply Heisenberg’s uncertainty principle in an 
entropic form first proven by M- It was later generalized 
|15l - ll^ to include correlation of the system to be mea¬ 
sured with disjoint (possibly quantum) systems A and E 
given by 


H{X\E) + H{Z\A)>-\og^C, (2) 

where X and Z are results from POVMs X and Z respec¬ 
tively on B. Writing the POVM elements of X and Z as 
{AJ} and {Af} respectively, the term C is given by 

C = max 

X,Z 

Eq. (I2|) together with the Devatak-Winter security bound 
(l8l [ is employed in Q to provide a security proof for the 
purified SDC and LM05 protocols. In order to make use 
of such an entropic relation, Q necessarily describes the 
termC as the (effective) overlap between Bob’s measuring 
apparatus in a RR picture. In the purified SDC protocol, 
Bob’s measurements are either the Bell measurements or 
a measurement that can be described as cr^ 0 ctj, where 
the overlap between the POVM elements as defined in 
eq.® is 1/4. This maximal overlap is achieved when 
considering the overlap between the POVM elements in 
EM and that of in CM. If we let the measurements by 
Alice and Bob to result in the strings S'™ and S®“ 
respectively from EM and S™ and S™ respectively 
from CM, and Eve’s system as E we can bound Eve’s 
information based on eq.© as 

H{Sf^\E) + H{S%^\Sf^) > 2. (4) 

With i7(S™|S™) upper bounded by hi^qcm) and 
i7(S™|S™) by h 4 {qEM) where /14 is the 4-ary Shannon 



entropy, qcu and are errors in Alice’s and Bob’s 
strings in CM and EM respectively, the key rate of the 
SDC, Rsdc, is given by the Devatak-Winter rate [l^ 

Rsdc > 2 — h4{qQy^) — h^i^qEyi)- (5) 


It is instructive to note that the errors Pcm 9em 
affects a two-bit message transmission resulting from a 
use of two noisy channels and thus comes as a triple; 
namely error exclusively in either one channel, say g“ and 
gf as well as errors in both channels, gf for a = CM, EM. 
Hence, 


hiiqa) = - ^ log2 9“ - (1 - ^ 9 *“) log2 ( 1 - X! 


It is certainly possible to consider the entropic bounds 
dictated by the overlap of Alice’s apparatus instead of 
Bob’s as shown above. The key rate would remain the 
same nonetheless. 


A similar line of argument can be applied to the 
LM05 protocol; though the measurements made for 
decoding purposes by Bob would he Z = ^ or 

X = ax ® Ux followed by an XOR of the the measure¬ 
ments’ results to reveal the encoding done by Alice in 
the EM. Another set of measurements, which would be 
useful for the CM would be Zq = a^® I or Xc = ax® I 
where the maximal overlap between the POVM elements 
for measurements made in EM and that in CM is 1/2. 
Using the relevant entropic bounds (similar to SDC 
though the overlap is now 1/2 instead of 1/4), the key 
rate for LM05, Rlmo 5 can be easily shown to be 

Rlmob > 1 — h 2 (gcM) — h 2 (gEM), (7) 

where /12 is the binary Shannon entropy and gcM and 
gEM are the errors in the CM and EM respectively. 

The above key rates are derived from inequalities based 
on terms that are meaningful only within the infinitely 
long key limits and is thus unsatisfactory from an oper¬ 
ational and practical perspective. In the following sub¬ 
section, we shall review briefly the notion of smooth en¬ 
tropies and relevant entropic bounds that we shall use to 
derive a finite key rate for SDC and LM05. 


C. Smooth Entropies and Finite Keys 

The smooth entropy is defined based on the conditional 
entropy. More rigorously, following the definition given 
in [20| for a bipartite state pbe on B and E, the entropy 
of B given E is defined as 

Hrmn{B\E) = maxsup{A e K : 2~^Ib ® Pe > Pbe} ( 8 ) 

PE 

where the maximum is taken overall states ps in E and 
/s is the identity on B. The e-smooth min-entropy for 
e > 0 is then defined as 

H}:^^^[B\E) =vn‘AyiHmin{B\E). (9) 

P 






4 


with maximization over all bipartite states p on B and E 
with a purified distance [2l| to psE not exceeding e. The 
smooth max-entropy is defined as the dual of the smooth 
min-entropy with regards to any purification of pbe- 
For the tripartite state pabe and POVMs X and Z re- 
SMctively on B (resulting in bit strings X and Z), from 
[20|, the smooth min-entropy of X conditioned on E, 
H^i^{X\E), gives the number of bits contained in X 
that are e-close^ to a uniform distribution and indepen¬ 
dent of E. The smooth max-entropy of Z conditioned 
on A, H^g^^{Z\A), gives the number of bits needed to 
reconstruct Z from A up to a probability of failure e and 
the generalized uncertainty relation involving smooth en¬ 
tropies is given as 


h:^,^{x\e) + h:, 


,{Z\A)>-\og^C. 


( 10 ) 


In identifying the measurements and results in both 
the SDC and LM05 with ea. ifTOll . similar to the above, 
H^^^{X\E) will be identified with Eve’s correlation with 
Bob’s string (in EM) while E[^^^{Z\A) is to be identified 
with Alice’s and Bob’s in CM. There are two points worth 
mentioning with regards to the measurements made in 
CM. The first is in particular reference to CMOS’s mea¬ 
surements Zc and Xc where a passive operation is noted 
on the second qubit (received in the backward path). 
This does not necessarily require Bob to not measure the 
qubit in the backward path; rather he could just ignore 
the measurement made and consider only the result of 
his first measurement.^ In other words, in the cases Al¬ 
ice note a particular round of the protocol is a CM, Bob 
would ignore the result of his measurement on the sec¬ 
ond qubit. If it was the EM, then both the measurement 
results would be XOR-ed for decoding purposes. 

The second point is that as the 0 cr^, in SDC and 
Zc and Xc in LM05 happens only in CM, one can see 
the protocol as analogous to the asymmetrical prepare 
and measure protocol of BB84 where the measurements 
in EM is seen as measurements in the preferred basis in 
the asymmetrical BB84. In the case for the latter, in 
M , where measurements are made in the X and Z, a 
gedankenexperiment was considered where all measure¬ 
ments were done in the Z basis to establish an uncer¬ 
tainty relation. Following , in the case for the LM05, 
we can use the bits derived in the CM to provide for an 
estimation of the errors in the application of the uncer¬ 
tainty relation using a similar gedankenexperiment where 
all rounds are CM; and since Bob can choose to measure 
for EM, security follows from the notion that the better 
Alice could estimate Bob’s bits in CM, the worse would 
Eve’s estimation of Bob’s bits in EM. 


III. EFFICIENCY AND SECURE KEY RATES 

In what follows, we shall assume implementations of the 
two-way protocols using depolarizing channels. The de¬ 
polarizing channel, T) is described by the parameter q, 
such that 0 < g < I, which affects a quantum state, p 
independent of the basis as such 

peAV{p) = {I-q)p + qI/2. (II) 

For two-way protocols, the use of depolarizing channels 
can be categorized as either independent or correlated 
channels. Such a correlation can be understood in terms 
of the errors estimated in the forward and backward 
paths in CM against errors in EM. Given bit wise er¬ 
rors ei and 62 in the forward and backward paths re¬ 
spectively, we say the channels are independent provided 
the errors in EM is given by = ei(l — 62 ) -I- 62(1 — ei). 
Otherwise they are correlated . While the case for inde¬ 
pendent channels are unique by definition, the cases for 
correlated channels can be infinitely many. However, we 
shall only consider, as in @ correlated channels where 
61 = 62 = G - m - 

To ascertain a finite key rate for the two-way protocols 
given such implementation, we need to determine the dis¬ 
tribution of finite number of bits between the EM and the 
CM. Choices of the value of c for both protocols would 
determine this and ultimately how much of a key rate one 
can have. Hence, in order to determine the optimal value 
for c, assuming one has a value of k for bits in CM and 
n in EM (more precisely the cases where Alice’s encod¬ 
ing measurements coincide with Bob’s decoding measure¬ 
ments), the total number qubits, M(n,k) sent® before n 
bits are derived from EM and k for CM estimation can 
be made is given by probability value c = (yA + k/n)~^. 
This is immediately derived from modelling the protocol 
based on 0. 

Subsequently, the already mentioned gedankenexperi¬ 
ment will provide for an uncertainty relation of eq. m 
and the smooth-max entropy term for an n-bit string, 
Z given C, E[^^^{Z\C) would be upper bounded by 
nh 2 {Q -f p{n, k)) where 

I [nTTkTT Y 

with the strings Z and C derived from CM differing at 
Q bits. The parameter 65 > 0 is a security parameter as 
defined in [l^ . 

Strings shared between Alice and Bob in the EM, 
which one party’s may be characterized as having er¬ 
rors e relative to the other need be subjected to an error 


^ According to a distance that is based on the same notion of 
purified distance, for the classical register X arising from POVM 
X on B, given quantum side information E 
^ The results should coincide with Alice’s measurement in CM 
when their bases coincide. 


^ A similar case for correlations between errors in the forward and 
backward path in CM was studied in a 
^ While for LM05 only a single qubit travels to and fro between the 
communicating parties, the case for SDC makes use of entangled 
pairs. Thus M{n, k) for SDC must be understood as number of 
qubit pairs. 
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correction procedure. This can conventionally be under¬ 
stood as the amount of pre shared secret bits invested in 
the communications for error correction purposes®. 

The Leftover Hashing Lemma [2^ then provides for 
the length of the secret key as 

L=[H:^,^{X\E) + 2log2e\, (13) 

which is 2e close to a bit string which is uniform and 
independent of Eve’s knowledge. 

The efficiency of the protocol, £ can be defined based 
on the amount of resources in terms of number of qubits 
required, 

£ = L/M{n,k). (14) 

It should be noted that for SDC, a factor of 2 should 
be further multiplied to the denominator reflecting the 
use of entangled pairs. As in [a , we do not include any 
classical bits necessary in the protocol unlike [^ . 


where q/2 is the error rate for each independent depo¬ 
larizing channel in the CM. If we write the smooth max- 
entropy of Alice’s string conditioned on Bob’s in EM as 
^max(*5'l^|<S'™) < nhi{QE) with Qe as errors in the 
EM, then equations (HSl), ([TSl) and (II3 gives the key 
length after error correction and privacy amplification as 


Lsdc < n 


2-2h, 


(I + - hA{QE) 


-log^, 

(18) 


where from we have the term nh 4 (QE) as the 

amount of information leaked to Eve due to error cor¬ 
rection of the string S'™ and log (e^ results from the 
quantum Leftover Hashing Lemma [23j. 


B. Finite Key Analysis for LM05 


A. Finite Key Analysis for SDC 

We let a total of 2M{n,k) pairs of qubits travel to and 
fro between Bob and Alice with the latter committing to 
encoding with probability c. Thus one gets n amount of 
quaternary digits from the EM. Eollowing earlier nota¬ 
tion, the n quaternary strings of Alice and Bob are S™ 
and Se^ respectively while the k quaternary strings de¬ 
rived from the CM are S™ and S™ respectively. Con¬ 
sidering a gedankenexperiment where all runs are CM lets 
us bound Eve’s information on the n quaternary string 
using equation m as 

HL^niST\E) + > 2n. (15) 

The term is the smooth min-entropy of 

S'™ conditioned on E. It reflects Eve’s correlation 
with Bob’s string in the EM giving the number of bits 
contained in S™ that are e-close to a uniform dis¬ 
tribution and independent of E. In ascertaining the 
term I^maa:('5'B'^|S™) reflecting the correlation between 
Bob’s and Alice’s strings, the case for two way channels 
with depolarization q each allows us to consider bit error 
rate in qubit measurements as q/2 for each channel in¬ 
stead of a channel transmitting quaternary digits instead. 
Thus in this case, 

h4{q) = 2hi{ql2), (16) 

for q = {{1 — q/2)q/2, (g/2)(l — q/2), g^/4). The number 
of bits required to reconstruct S'™ from S™ (as two n 
bit length strings) up to a probability of failure e, 

(I + Kn, k)) , (17) 


It is possible to consider a more practical scenario, for example 
for a bit string with error rate e, a cofactor would be multiplied 
to the amount bits needed for such a purpose given by / 12 (e). 


In this work, we will only focus on the first version of the 
LM05 protocol where Bob’s choice for qubit preparation 
and measurement in the Z bases is preferred {pz ~ 1) 
and Alice either encodes with anyone of her transforma¬ 
tions with probability c/4 or make measurements in the 
X bases is with probability I — c. Eurthermore, the de¬ 
liberations ensue would be focused on the RR scenario. 
Alice’s and Bob’s choice of measuring 2M{n,k) qubit 
pairs in the basis X with probability 1 — c results in 
Ue = n + '/nk number of bits derived from EM and k 
for CM. Hence ^/nk pairs would be wasted due to bases 
mismatch when Alice measures in X while Bob chooses 
Z (notice that 2\/nk qubits are wasted in 0 for similar 
reasons). 

Let us write the string Bob has in the EM and CM as 
s™ and s™ respectively as well as Alice’s as s™ and 
s™ respectively. As described above, let us consider a 
gedankenexperiment where all qubits are measured using 
X basis (for CM), we can therefore write an uncertainty 
relation from equation (HOD to bound Eve’s information 
as 

H:^,^isT\E) + > ne. (19) 

Similar to earlier discussions, the first term in the left 
hand side of the above equation is the smooth min- 
entropy reflecting the number of bits contained in Bob’s 
string, s™ that are e-close to a uniform distribution and 
independent of Eve. The second term 
reflects the correlation between Bob’s and Alice’s strings 
and gives the number of bits needed to reconstruct s™ 
from s™ up to a probability of failure e, 

< neh2 (| + fc)) . (20) 

With Qf as the error rate in EM, noting 
i7)/(j3,(s™|s™) < nf,h 2 {Qf) and following equations 
dni), (HU), (EOl), the key length after error correction and 
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privacy amplification is given by 

LlM05 < ne - ne/l2 (I + 


-neh 2 iQf) ~ log- 


( 21 ) 


IV. NUMERICAL RESULTS AND 
COMPARISONS 

In making use of the key rate formulae of equations (fTSl) 
and (ED) above, we need to first assume a value for the se¬ 
curity parameter es, for which we set as Then, for 

a given value for errors in the CM (errors in EM is then 
immediately defined), setting the number for M (n, fc), we 
determine the value k which achieves the maximal value 
for secure key length. As M{n, k) approaches infinite for 
n —?► oo, following m we could let k < IC^/n for some 
fixed /C, so that 

lim /r(n, k) = 0, (22) 

n—^oo 

and consider secure keys within the infinite key regime. 
In the infinite key regime, the efficiency for the protocols 
SDC becomes 

lim LsDcl2M{n, fc) = 1 - ^2 - MM, (23) 

n—>oo \Z/ Z 

and for LM05 we have 

lim LLM 05 /M{n,k) = 1 - /12 - h 2 iQf). (24) 

n—)-oo \Z/ 

It is worth noting that the ‘additional’ term '/nk 
for amount of bits that can be derived from EM in 
LM05 becomes negligible in the infinite key regime and 
'/nk/M{n,k) = 0. Furthermore, for this con¬ 
dition, it would be only the final term (related to error 
correction) that would determine how one protocol out¬ 
performs another. 

A. Independent Channels 

In Figures 1 and 2, we present the results for implemen¬ 
tations of the SDC and LM05 for independent channels 
compared to the asymmetrical BB84 in terms of protocol 
efficiency against errors. In this case, the error rates for 
SDC and LM05 in EM are given by 2q/2{l — q/2) and 
{2q — q^)/A respectively 

We can observe that there are particular regions where 
LM05 outperforms both SDC and BB84. Generally, this 
can be understood when considering the competing terms 
of the extra ^/nk contributing to LMOS’s raw key versus 
the amount of bits to be discarded due to error correc¬ 
tion. For LM05, this is given by /i2[2g/2(I — g/2)], SDC’s 
h4[{2q — (7^)/4]/2 while for BB84, it is simply h2{q/2) 
where 

h2[2g/2(I - q/2)] > hi[{2q - q^)/A]/2 > h2(g/2), (25) 



FIG. 1: Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDC (green) against error rate q/2 given independent 
channels for total qubit used as M = 10"^. 



FIG. 2: Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDC (green) against error rate q/2 given independent 
channels for total qubit used as M = 10^. 

with equality only at g = 0 or g = I. The term y/nk 
is most dominant for relatively small values of n, hence 
LMOS’s best performance of the three in Figure [T] where 
M{n, k) = 10^. In the same figure we see instances when 
the errors are big enough and outweighs the contribution 
from y/nk, LM05 performs poorly compared to BB84. 
The error correction term for SDC is only very slightly 
better than that of LM05 in the infinite key regime, ex¬ 
plaining why it still does not exceed LMOS’s yfnk advan¬ 
tage in the finite key scenario here. Thus LM05 exceeds 
BB84 up to an error rate of about 2.7%. However, in Fig¬ 
ure [2] where the number of qubits used, M{n,k) = 10^, 
LM05 exceeds BB84 only up to about 1% and SDC’s 
up to 3.8%. The plot of the protocols’ efficiency against 
M{n,k) for the error of O.OI in Figure |3] exhibits the 
convergence of the efficiencies as the number of qubits 
used increases up to 10^. These results clearly empha¬ 
sizes LMOS’s determinism over the asymmetric BB84’s. 
It is worth recalling the fact that while LM05 claims de¬ 
terministic status in terms of the absence for bases mis¬ 
match in EM, BB84 only approximates this (in the infi¬ 
nite key regime). Figure 2] exhibits the case for the three 
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FIG. 3: Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDC (green) against total qubit used, M (for SDC, it is 
to be understood as total pairs used) for error rate 0.01. The 
horizontal dashed lines represents the inhnite key regime. 



FIG. 4: Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDG (green) against error rate q/2 given independent 
channels in the infinite key limit 


protocols in the infinite key regime. 


B. Correlated Channels 

In Figures [5] and [6] we present the results for implemen¬ 
tations of the SDC and LM05 for correlated channels 
compared to the asymmetrical BB84 in terms of their ef¬ 
ficiencies against errors in the channel. We reiterate that 
we consider a particular model for correlated channels; 
i.e. specified by ei = 62 = and the error rates for 
SDC and LM05 in EM are given by g/2 and g/4 respec¬ 
tively 

In both the figures we see LM05 outperforming BB84 
though in the second only marginally. This can be under¬ 
stood as due to going to infinite key limit where the two 
efficiencies should converge (binary entropic function for 
the bits to be discarded for both protocols in correlated 
channels is essentially given by the same form). This is 



FIG. 5: Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDG (green) against error rate q/2 for total qubit used as 
M = 10^ for correlated channels specified by ei = 62 = Cm. 



Error, q/2 

FIG. 6 : Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDG (green) against error rate q/2 for total qubit used as 
M — 10^ for correlated channels specified by ei = 62 = Cm. 

illustrated in Figure 0 for increasing qubits used and 
further highlighted in Figure ([8]) where the black curve 
represents both the LM05 and BB84’s key rate. However 
what is interesting is the fact that for finite number of 
qubits used, LM05 exceeds BB84 in terms of a higher tol¬ 
erance towards errors clearly exemplified in Figure ([S]) . 
This is almost unexpected as looking at the key rate for¬ 
mulas, one would imagine that the amount of bits to be 
discarded due to error correction and privacy amplifica¬ 
tion are essentially the same (relative to the key rates). 
However, a difference exists when considering the statisti¬ 
cal fluctuation term. As LM05 allows for a larger number 
of bits to be salvaged in EM, thus a greater number of 
bits in CM (compared to BB84) may be used for error 
estimation in bounding Eve’s information in the entropic 
relation. This allows for ^{ne,ke) < ^i{n,k) implying 

h2 (I + fe)) > (I + K'n-e, ke)j ■ (26) 

Hence, for the same error in a channel, BB84 discards 
more bits than LM05, explaining LM05’s higher error 










FIG. 7: Efficiency for Asymmetrical BB84 (blue), LM05 (red) 
and SDC (green) against total qubit used, M (for SDC, it is 
to be understood as total pairs nsed) for error rate 0.01 for 
correlated channels specified by ei = 62 = Cm- The horizontal 
dashed lines represents the infinite key regime. 



FIG. 8 : Efficiency for Asymmetrical BB84, LM05 (both 
black) and SDC (green) against error rate q/2 for correlated 
channels specified by ei = 62 = Cm in the infinite key limit. 

tolerance. This would be essentially the same reasoning 
for LM05’s performance over SDC’s in figure SI 

SDC’s better performance when compared to BB84’s 
in both figures and LMOS’s in figure [S] is mainly due to 
the error correction term. In this particular model for 
correlated channels, the following inequality holds, 

h2iq/2) > hiiq/A), (27) 

where less bits are discarded for error correction in SDC 
and equality holds only for <7 = 0. The infinite key regime 
of Figure ([51) sees identical performance for both LM05 
and BB84 while SDC exceeds both. 


V. CONCLUSION 

Protocols making use of bidirectional quantum channels 
like the ones described in this work have the interesting 


feature of encodings being embedded in a unitary trans¬ 
formation as opposed to the preparation of a quantum 
state as well as the added advantage of how a decoding 
procedure should not see wastage due to bases mismatch 
unlike the conventional BB84. By conventional we re¬ 
fer to the BB84 in its original form where the choice 
of bases is equiprobable, resulting in only half of qubits 
transmitted could be used as a raw key. While asymmet¬ 
ric BB84 is proposed as a remedy and is expected to not 
perform any less than the two ‘deterministic’ protocols 
in the infinite key regime, the scenario for finite keys can 
be different; thus the motivation for this work. 

Noting how the choice of relevant probability distri¬ 
bution for EM and CM is immediately analogous to the 
asymmetric BB84’s choice for the preferred basis and non 
preferred basis respectively in 0 , we extend the security 
proof based on purified versions of the SDC and LM05 in 
[3 to the use of smooth entropies for a finite key analysis. 
We provide for secure key rates in terms of efficiency for 
the protocols. 

In relatively small number of qubits resources used (or¬ 
der of 10^) as well as lower depolarization of channels, 
we observe an obvious advantage in LM05 due to having 
more bits for raw key purpose (derived from EM). This 
results from LMOS’s encoding/ decoding process which 
is independent of Bob’s choice of bases for measurement 
processes; which is in fact the ‘deterministic’ merit claim 
of the protocol. This advantage does however diminish 
in the region of asymptotically long keys when compared 
to BB84 (as well as the SDC). 

The SDC is in some sense very similar to the asymmet¬ 
ric BB84 as bits for key purposes can only be salvaged 
when both Alice’s and Bob’s encoding and decoding pro¬ 
cesses respectively coincide (unlike LM05 where Bob’s 
measurements in CM would be equally meaningful as a 
decoding measurement in the EM). The only real advan¬ 
tage SDC has over BB84 would be in the correlated chan¬ 
nels case due to the error correction procedure. However, 
one must bear in mind that while efficiency for LM05 
and BB84 is measured as key bits per-qubits transmitted, 
SDC’s is measured as key bits per-entangled pairs used. 
Practically, this may not set to provide for a promising 
scenario as quantum memories become a necessity. 

We conclude saying that a finite key analysis would be 
enlightening also for two-way QKD in the framework of 
continuous variable Q. 
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